1 /*
2 * Copyright (c) 2011, PADL Software Pty Ltd.
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 *
9 * 1. Redistributions of source code must retain the above copyright
10 * notice, this list of conditions and the following disclaimer.
11 *
12 * 2. Redistributions in binary form must reproduce the above copyright
13 * notice, this list of conditions and the following disclaimer in the
14 * documentation and/or other materials provided with the distribution.
15 *
16 * 3. Neither the name of PADL Software nor the names of its contributors
17 * may be used to endorse or promote products derived from this software
18 * without specific prior written permission.
19 *
20 * THIS SOFTWARE IS PROVIDED BY PADL SOFTWARE AND CONTRIBUTORS ``AS IS'' AND
21 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23 * ARE DISCLAIMED. IN NO EVENT SHALL PADL SOFTWARE OR CONTRIBUTORS BE LIABLE
24 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
30 * SUCH DAMAGE.
31 */
32 /*
33 * Copyright 2004 Sun Microsystems, Inc. All rights reserved.
34 * Use is subject to license terms.
35 */
36
37 /* #pragma ident "@(#)g_userok.c 1.1 04/03/25 SMI" */
38
39 #include <stdio.h>
40 #include <stdlib.h>
41 #include <string.h>
42 #ifdef HAVE_UNISTD_H
43 #include <unistd.h>
44 #endif
45 #include <mglueP.h>
46 #include <gssapi/gssapi.h>
47
48 static OM_uint32
mech_authorize_localname(OM_uint32 * minor,const gss_union_name_t unionName,const gss_union_name_t unionUser)49 mech_authorize_localname(OM_uint32 *minor,
50 const gss_union_name_t unionName,
51 const gss_union_name_t unionUser)
52 {
53 OM_uint32 major = GSS_S_UNAVAILABLE;
54 gss_mechanism mech;
55
56 if (unionName->mech_type == GSS_C_NO_OID)
57 return (GSS_S_NAME_NOT_MN);
58
59 mech = gssint_get_mechanism(unionName->mech_type);
60 if (mech == NULL)
61 return (GSS_S_UNAVAILABLE);
62
63 if (mech->gssspi_authorize_localname != NULL) {
64 major = mech->gssspi_authorize_localname(minor,
65 unionName->mech_name,
66 unionUser->external_name,
67 unionUser->name_type);
68 if (major != GSS_S_COMPLETE)
69 map_error(minor, mech);
70 }
71
72 return (major);
73 }
74
75 /*
76 * Naming extensions based local login authorization.
77 */
78 static OM_uint32
attr_authorize_localname(OM_uint32 * minor,const gss_name_t name,const gss_union_name_t unionUser)79 attr_authorize_localname(OM_uint32 *minor,
80 const gss_name_t name,
81 const gss_union_name_t unionUser)
82 {
83 OM_uint32 major = GSS_S_UNAVAILABLE; /* attribute not present */
84 gss_buffer_t externalName;
85 int more = -1;
86
87 if (unionUser->name_type != GSS_C_NO_OID &&
88 !g_OID_equal(unionUser->name_type, GSS_C_NT_USER_NAME))
89 return (GSS_S_BAD_NAMETYPE);
90
91 externalName = unionUser->external_name;
92 assert(externalName != GSS_C_NO_BUFFER);
93
94 while (more != 0 && major != GSS_S_COMPLETE) {
95 OM_uint32 tmpMajor, tmpMinor;
96 gss_buffer_desc value;
97 gss_buffer_desc display_value;
98 int authenticated = 0, complete = 0;
99
100 tmpMajor = gss_get_name_attribute(minor,
101 name,
102 GSS_C_ATTR_LOCAL_LOGIN_USER,
103 &authenticated,
104 &complete,
105 &value,
106 &display_value,
107 &more);
108 if (GSS_ERROR(tmpMajor)) {
109 major = tmpMajor;
110 break;
111 }
112
113 if (authenticated &&
114 value.length == externalName->length &&
115 memcmp(value.value, externalName->value, externalName->length) == 0)
116 major = GSS_S_COMPLETE;
117 else
118 major = GSS_S_UNAUTHORIZED;
119
120 gss_release_buffer(&tmpMinor, &value);
121 gss_release_buffer(&tmpMinor, &display_value);
122 }
123
124 return (major);
125 }
126
127 /*
128 * Equality based local login authorization.
129 */
130 static OM_uint32
compare_names_authorize_localname(OM_uint32 * minor,const gss_union_name_t unionName,const gss_name_t user)131 compare_names_authorize_localname(OM_uint32 *minor,
132 const gss_union_name_t unionName,
133 const gss_name_t user)
134 {
135
136 OM_uint32 status, tmpMinor;
137 gss_name_t canonName;
138 int match = 0;
139
140 status = gss_canonicalize_name(minor,
141 user,
142 unionName->mech_type,
143 &canonName);
144 if (status != GSS_S_COMPLETE)
145 return (status);
146
147 status = gss_compare_name(minor,
148 (gss_name_t)unionName,
149 canonName,
150 &match);
151 if (status == GSS_S_COMPLETE && match == 0)
152 status = GSS_S_UNAUTHORIZED;
153
154 (void) gss_release_name(&tmpMinor, &canonName);
155
156 return (status);
157 }
158
159 OM_uint32 KRB5_CALLCONV
gss_authorize_localname(OM_uint32 * minor,const gss_name_t name,const gss_name_t user)160 gss_authorize_localname(OM_uint32 *minor,
161 const gss_name_t name,
162 const gss_name_t user)
163
164 {
165 OM_uint32 major;
166 gss_union_name_t unionName;
167 gss_union_name_t unionUser;
168 int mechAvailable = 0;
169
170 if (minor == NULL)
171 return (GSS_S_CALL_INACCESSIBLE_WRITE);
172 *minor = 0;
173
174 if (name == GSS_C_NO_NAME || user == GSS_C_NO_NAME)
175 return (GSS_S_CALL_INACCESSIBLE_READ);
176
177 unionName = (gss_union_name_t)name;
178 unionUser = (gss_union_name_t)user;
179
180 if (unionUser->mech_type != GSS_C_NO_OID)
181 return (GSS_S_BAD_NAME);
182
183 /* If mech returns yes, we return yes */
184 major = mech_authorize_localname(minor, unionName, unionUser);
185 if (major == GSS_S_COMPLETE)
186 return (GSS_S_COMPLETE);
187 else if (major != GSS_S_UNAVAILABLE)
188 mechAvailable = 1;
189
190 /* If attribute exists, we evaluate attribute */
191 major = attr_authorize_localname(minor, unionName, unionUser);
192 if (major == GSS_S_COMPLETE || major == GSS_S_UNAUTHORIZED)
193 return (major);
194
195 /* If mech did not implement SPI, compare the local name */
196 if (mechAvailable == 0 &&
197 unionName->mech_type != GSS_C_NO_OID) {
198 major = compare_names_authorize_localname(minor,
199 unionName,
200 unionUser);
201 }
202
203 return (major);
204 }
205
206 int KRB5_CALLCONV
gss_userok(const gss_name_t name,const char * user)207 gss_userok(const gss_name_t name,
208 const char *user)
209 {
210 OM_uint32 major, minor;
211 gss_buffer_desc userBuf;
212 gss_name_t userName;
213
214 userBuf.value = (void *)user;
215 userBuf.length = strlen(user);
216
217 major = gss_import_name(&minor, &userBuf, GSS_C_NT_USER_NAME, &userName);
218 if (GSS_ERROR(major))
219 return (0);
220
221 major = gss_authorize_localname(&minor, name, userName);
222
223 (void) gss_release_name(&minor, &userName);
224
225 return (major == GSS_S_COMPLETE);
226 }
227